Security

Everything on this page is something we actually operate. There are no badges on it, because we have not earned any, and a badge would be the least informative thing here anyway.

In place today

What we do

Seven things, each of which is running in production right now and can be checked.

Your audio is reachable only through signed links

Audio is never served from the API and never sits behind a cookie. Every read or write is a short-lived signed URL scoped to one object and one operation, verified against the workspace it was minted for.

Untrusted audio is decoded in a sandbox

A malformed media file is the most direct attack surface an audio platform has, so decoding runs with its own user, network and process namespaces, no capabilities, a memory ceiling and a wall-clock deadline. It was built before there was any public upload path to attack.

Staff can't listen to your audio

Not support, not operations, not an administrator. There's no control anywhere in our internal tooling that plays a customer's audio, and no path that mints a link to it. There's no exception path today either: if we ever need to hear a file to debug it, we'll ask you, and any future grant mechanism will be one you start yourself and can see.

Every internal read of your data is recorded

Reads, not only writes. Our operations console can't show a member of staff anything about your account without first writing an audit record naming them, what they looked at and why — and if that record can't be written, the data isn't shown. The audit store is append-only and lives in a separate database from the one it audits.

Dangerous operations need a second look

Pausing part of the platform, rolling back a model, and anything similar are staged with a written reason and carried out after a delay — or immediately if it's an active incident, in which case the reason is written first and a postmortem is owed. Every one of them is on a review list the next morning.

Backups are encrypted, and restoring them is drilled weekly

A full dump of every production database on a timer, encrypted with AES-256 as it's written — the plaintext exists only in the pipe, never as a file — then checksummed and kept for fourteen days. Without a key the backup doesn't run at all, rather than falling back to writing an unprotected second copy of everyone's data. Every Sunday a script decrypts the newest one into a scratch database, proves it's queryable and drops it. A restore procedure nobody has run is a hypothesis, not a procedure.

Dependencies and the host are patched on a cadence

Unattended security updates on the origin, a hardened OS baseline, and firewall rules kept as code rather than as history in a shell. Application dependencies are updated on a schedule and on advisory.

Disclosure

Reporting something

Email security@euphonaai.com. Tell us what you found and how to reproduce it; you do not need a proof-of-concept exploit and we would rather you did not build one against live data.

We will acknowledge within three working days and tell you what we are doing. We will not threaten you, and we will credit you if you want to be credited. There is no bounty programme — if one appears it will be on this page rather than negotiated by email.

Please do not access another person’s data, degrade the service for anyone else, or hold a finding for leverage. The machine-readable version of this is at /.well-known/security.txt.